Information Security Risk & Compliance Analyst

About the Role

The Information Security Risk & Compliance Analyst is responsible for the day-to-day tactical support of WPCU’s Information Security Risk program and Third-Party Risk Management (TPRM) program. This role works closely with business units, Information Technology, and Enterprise Risk Management, serving as the Information Security Subject Matter Expert (SME) for vendor risk management. The position performs risk assessments for products and technologies using frameworks such as CIS, NIST, MITRE ATT&CK, and OWASP Top 10, and ensures all identified risks are properly documented and managed.

Responsibilities

• Third Party Risk Management (TPRM) Program (40%):
  • Evaluate technology and cybersecurity risks presented by new and existing vendors, disaster recovery, or business continuity.
  • Collaborate with Vendor Risk Management to determine risk tiers and execute workflows for due diligence requirements.
  • Review and assess due diligence documents for adequacy, control effectiveness, and gaps.
  • Coordinate with business units to understand the impacts of identified risks.
  • Collaborate with Legal to ensure contract terms align with vendor due diligence requirements.
  • Document findings, residual risks, and recommendations within TPRM tools and Issue Management platforms.
  • Provide thought leadership on maturing the Information Security components of TPRM.
• Risk Assessment Methodology (40%):
  • Develop new risk assessments for emerging technologies like Artificial Intelligence (AI) based on industry standards (MITRE, NIST CSF).
  • Execute existing risk assessments to identify changes or drift from previous assessments.
  • Develop and maintain processes for identifying inherent likelihood, impact, and control effectiveness.
  • Collaborate with the Information Security team to assess control effectiveness impacts on existing risks.
  • Build and maintain a control library documenting all active/available controls.
  • Ensure adherence to policies, procedures, risk mitigation activities, and operating controls.
  • Report gaps in policies, procedures, and controls to leadership.
• Issue Management (20%):
  • Ensure risks exceeding enterprise risk appetite are entered into the Issue Management system promptly.
  • Review risk mitigation or remediation plans identified during risk assessments.
  • Track risks identified during projects or Control Effectiveness Reviews in Issue Management.
  • Provide thought leadership on monitoring and reporting of Issue Management.

Requirements

• Bachelor’s Degree in information technology, information security, or risk management (equivalent work experience considered).
• One of the following certifications: CISSP, CRISC, CTPRP, CRVPM, or similar (required within first year if not already certified).
• 3+ years of experience in information technology or information security, including at least 2 years in third-party risk management, vendor risk management, or cybersecurity risk management.
• Familiarity with MITRE framework, PCI-DSS, and NIST RMF.
• Ability to interpret SOC reports and cybersecurity controls.
• Valid driver’s license for travel to various locations.

Pay

Grade and Compensation Band: PG 18: $84,427.20 – $126,568.00 (Annually)
Target Compensation: $90,000 - $115,000